Shutoff system for pool or spa

ABSTRACT

A control system for a bathing installation which has one or more electrically powered devices. A line voltage service is connected through a GFCI to power the electrically powered devices, the GFCI adapted to interrupt the service upon detection of a ground fault. A trip circuit may induce a ground fault and trip the GFCI in response to a trip signal, thereby disabling application of electrical power to the electrically powered devices. An electronic circuit is responsive to a fault condition for generating the trip signal.

CROSS-REFERENCE TO RELATED APPLICATIONS

This is a division of application Ser. No. 11/112,524, filed Apr. 22,2005 now U.S. Pat. No. 7,417,834, and a continuation of application Ser.No. 12/184,177 filed Jul. 31, 2008 now U.S. Pat. No. 7,626,789, theentire contents of which applications are incorporated herein by thisreference.

BACKGROUND

Electronic control systems have been employed to control variousfunctions of bathing installations such as pools or spas. For example,the control system can control the pump which recirculates water in aspa. There can be malfunctions in which the pump continues to run, eventhough the controller has commanded it to the off condition, e.g. whenthe pump relay contacts providing power to the pump have fused together.When this occurs, the water temperature can slowly rise as the pumpruns, potentially creating a scalding threat to a user.

A concern for a spa or pool is that the suction generated by the waterflow may hold a person against a water outlet.

BRIEF DESCRIPTION OF THE DRAWINGS

Features and advantages of the disclosure will readily be appreciated bypersons skilled in the art from the following detailed description whenread in conjunction with the drawing wherein:

FIG. 1 is a simplified schematic diagram of a bathing installation.

FIG. 1A is a simplified circuit schematic of an embodiment of a GFCItrip circuit. FIG. 1B is a simplified circuit schematic of an alternateembodiment of a GFCI trip circuit.

FIG. 2 is a diagrammatic view of an exemplary embodiment of a pool andspa system utilizing aspects of this invention.

FIG. 3 is a simplified block diagram of elements of an exemplaryembodiment of a pool service system.

FIG. 4 illustrates an exemplary embodiment of a control panel cabinetfor housing the pool controller and power distribution system of thepool service system, and the service control panel mounted on thecabinet.

FIG. 5 is a diagrammatic view of the pool control panel comprising thesystem of FIG. 2.

FIG. 6 is a diagrammatic view of the spa control panel comprising thesystem of FIG. 2.

FIG. 7 is a detailed block diagram of the pool service of FIG. 3.

FIG. 8 is a schematic diagram of an exemplary embodiment of a simplifiedpool service system.

FIGS. 9A-9G are simplified flow diagrams illustrating exemplary salientprogram features of the controller comprising the system of FIG. 1, FIG.2 or the system of FIG. 10.

FIG. 10 illustrates an overall block diagram of a spa system withtypical equipment and plumbing installed.

FIG. 11 is a simplified schematic diagram of an exemplary embodiment ofthe electronic control system for the spa system of FIG. 10.

DETAILED DESCRIPTION

In the following detailed description and in the several figures of thedrawing, like elements are identified with like reference numerals.

A GFCI (ground fault circuit interrupter) is typically used for abathing installation. An exemplary embodiment of a bathing installationelectronic controller may be adapted to automatically test for thepresence of a properly functioning GFCI before it will start up thebathing installation system. In one exemplary embodiment, the first timethat the system is powered up after installation at a customer's site,the controller software activates a GFCI trip circuit. If the systemdoes not immediately shut down from tripping the GFCI, the controllerdisplays an error message and will not allow the bathing installation tooperate. If the system shuts down as expected, the controller willoperate normally after the GFCI is reset, and the system is re-started.In another exemplary embodiment, a manual test of the GFCI may beemployed when the system is installed at a user's site, with asubsequent automatic test conducted after a certain time has elapsedfrom the initial power-up, which is selected to be a longer period thanthe system manufacturer typically tests a system prior to shipping to adistributor or customer.

In an exemplary embodiment, a GFCI trip circuit is provided for abathing installation. The trip circuit is adapted to connect one side ofthe AC input power to ground through a resistor for a short period oftime, setting up a current flow long enough to trip the GFCI. The periodof time may depend on the particular GFCI implementation. As aprecaution in case the GFCI does not trip, a flag or state may be setand stored in an nonvolatile memory just before this occurs. If the GFCIdoes not trip for any reason, the controller may detect the flag orstate, turn off all devices, and enter a loop that does nothing butdisplay a warning message on the screen. In an exemplary embodiment, aservice technician may be required to repair and re-set the system toallow operation to resume.

An exemplary bathing installation 600 is depicted in the simplifiedschematic diagram of FIG. 1. The bathing installation includes a waterflow path 602, which may be a recirculating water flow path in the caseof a whirlpool bath, a spa or a pool installation. The installationincludes at least one electrically powered device, e.g. a pump 606 or awater heater 607; other examples of electrically powered devices whichmay be employed with the installation include lights, valve actuators,voltage transformers and the like. An electronic control system 100 isprovided which controls operation of the bathing installation includingits electrically powered devices. The control system 100 may include amicroprocessor 402 and a nonvolatile memory 403. Line voltage service 60supplies electrical power to the bathing installation through a GFCI 62.The GFCI may be a stand-alone circuit external to controller 100 in oneexemplary embodiment, and may also be integrated as part of a controllerin another exemplary embodiment. A GFCI trip circuit 500 is provided asa means for inducing a ground fault to trip the GFCI in response todetected safety or fault conditions. For example, the GFCI trip circuitmay be actuated in response to a trip signal 620 or a safety signal 630,either one of which may be generated by the control system 100 or byanother circuit device. In one exemplary embodiment, the trip circuit isactuated as a final protective measure, after intermediate measures havebeen taken to address a given condition, or after monitoring a conditionto ensure that the GFCI 62 is not unnecessarily tripped. For example,the safety signal may be indicative of a blockage in the water flowpath, and other measures, e.g. issuing a command to turn off the pumpand/or a valve to admit air into the water flow path to break a vacuum,or waiting a period of time and re-checking the safety signal, have beentaken and have failed to address the condition. The fault condition maybe indicated by a relatively high temperature of the water or by a rateof temperature rise in the water flow path. The controller may firstattempt to address the condition by turning off the heater and the pump,and subsequently monitoring the water temperature for some period oftime. If the temperature condition is not alleviated, and if thetemperature rises, which may indicate a stuck pump relay or othermalfunction, the controller may be programmed to activate the GFCI tripcircuit to trip the GFCI. These are only examples of safety or faultconditions which may be addressed by the bathing installation depictedin FIG. 1.

FIG. 1A illustrates an exemplary embodiment of a GFCI trip circuit 500suitable for use in a bathing installation. For example, an exemplarybathing installation may include an electronic control system comprisinga microcomputer, illustrated as microcomputer 402 in FIG. 1A. Thecircuit 500 includes a terminal 514 which is coupled to the electroniccontrol system, e.g. to the microcomputer 402, to receive a commandsignal on terminal 514 tripping the GFCI. The purpose of the circuit 500is to selectively create a current flow, e.g. 9 ma in this example,between the 120AC black lead 510 and chassis ground 512. This currentflow results in a current imbalance, which is detected by and trips theGFCI, shutting down the bathing system. This exemplary embodiment of theGFCI trip circuit comprises a transistor switch 502, whose gate iscontrolled by the voltage on terminal 514. The transistor 502 may beimplemented, for example, by a 2N7002/SOT transistor. When thetransistor 502 is conducting in the on state, a triac device 504 isturned on. An exemplary commercially available opto-isolated triacdevice suitable for the purpose is the MOC3021M device marketed byFairchild. The triac 504 is connected in series with a resistor 516,between the 120 black lead 510 and the chassis ground 512, and thus whenthe triac device is conducting, a current flows to ground. The resistorvalue in an exemplary embodiment is 15 Kohm. When the voltage on commandterminal 514 is low, the transistor 502 is biased to the off state,turning off the triac 504.

FIG. 1B illustrates another embodiment of a GFCI trip circuit 500-1.This embodiment is similar to the embodiment of FIG. 1A, but employs arelay circuit 520 instead of a triac. A pair of jumper terminals 526 areprovided for enabling operation of the trip circuit. There may beapplications for which the GFCI trip circuit is not to be operable, andthe trip enable jumper terminals allow disabling this function.

There may be conditions in which it is desirable to provide a means toshut down power to the bathing installation, e.g. a spa system, in theevent of a failure mode that typical protective circuits or spacontroller algorithms may not adequately address. An example is a pumpfailure that causes an excessive amount of current to be drawn onstartup. Such a failure may damage the contacts of the relay thatprovides power to the pump, welding the contacts together. If thishappens, even though the relay is commanded by the controller to open toshut off the pump, the pump will continue to run. When the pump runscontinuously, kinetic heating from the pump may be transferred into thespa water, causing the water temperature to slowly increase. Eventuallythe water can get so hot as to damage the spa, or become a scaldingconcern if a user does not check the water temperature before entry.

In an exemplary embodiment, the GFCI trip circuit provides a means forthe controller to shut down the system in event of an occurrence such asa stuck or inoperative relay.

In an exemplary embodiment, the electronic controller and spa system mayhave multiple high-limit mechanisms designed to shut down the system inthe event of an over-temperature condition. For example, at a givenelevated temperature, say 110° F., the controller may be programmed toshut down all devices in the system by opening all relay coils andshutting off all triacs which control devices such as pumps and heaters.If the temperature continues to rise, at another temperature point, say116° F., an independent hardware high-limit circuit may shut down theheater by opening heater high-limit relays in the system. If thetemperature still continues to rise, say to 118° F., the controller mayagain (redundantly) de-energize all relay coils and shut off all triacs.As an additional protective measure in this exemplary embodiment, theGFCI trip circuit provides an additional shutdown mechanism in the eventthe water temperature still continues to rise, as in the exemplary caseof a stuck pump relay. If the controller detects that the watertemperature has reached some predetermined elevated temperature, say120° F., under a predetermined additional condition or set ofconditions, the controller enables the GFCI trip circuit. The conditionor set of conditions is designed in an exemplary embodiment to reduce oreliminate tripping the GFCI under false positive indications basedpurely on a temperature reading. This trips the GFCI and shuts down allpower to the system, preventing the water temperature from continuing torise. If the spa user attempts to reset the GFCI, the controller maydisplay a critical error message for a short period of time, and thenonce again trip the GFCI. The error message may alert the spa user tocontact a service technician so that appropriate repairs can be made.

A concern for a bathing installation such as a spa is that the suctiongenerated by the water flow may hold a person against a water outlet.Some current spa controllers monitor an external safety signal, e.g. asignal from a vacuum switch 213 (FIG. 2) located in the water flow pathadjacent the input to the water pump 80, designed to indicate this andturn off all pumps when the signal is asserted. The pumps are notallowed to turn back on until the spa user presses a button on the panelto acknowledge the condition. In an exemplary embodiment, in accordancewith a further aspect of this disclosure, the external signal is checkedagain after the pumps have been turned off. If the external signal isstill asserted, an alarm may be activated (e.g., a visible message on acontrol panel display, and/or an audible warning), and the GFCI istripped to turn off all pumps. In an exemplary embodiment, the alarm mayturn off when the GFCI trips, since power is removed from the system,but if the spa remains powered for whatever reason, the alarm willcontinue to provide a warning to the user.

An exemplary embodiment of a system which may include the foregoingfeatures is shown in FIG. 2, a diagrammatic view of a pool and spasystem. Aspects of the system are described in further detail in U.S.Pat. No. 6,407,469, the entire contents of which are incorporated hereinby this reference. In this embodiment, the pool 1 and spa 2 share filter77 and heater 78 through a plumbing arrangement including three-wayvalves 70 and 72, although other arrangements can be employed, such asseparate heaters and filters for the pool 1 and spa 2. A skimmer 3 isincluded, and its drain line 7 and the pool drain line 6 are joined at ajunction tee before connection to one input of the valve 70. The drainline 5 from the spa is connected to the other input of valve 70. Thevalve output is connected to the input side of the filter pump 80through water line 8. A water line 9 runs from the pump output to thefilter input. The filter output is connected by water line 10 to theheater input. The heater output 11 is connected to the input of thethree-way valve 72. One output of the valve is connected to water line12 leading to a pool inlet. The other output of valve 72 is connected towater line 13 leading to a spa inlet.

The system includes pool and spa lights 90A, yard lights 90B, and adecorative fiber optic lighting system 88 typically mounted along thepool coping.

A controller and power distribution system 100 controls operation of thesystem 50, and which receives AC line voltage service, and distributesline voltage to the line voltage loads, including the heater, pump,lights and fiber optic lighting. The controller 100 further controls theoperation of the line voltage loads, and the valves 70 and 72. Moreover,the controller 100 may receive input data from a variety of sensors,which may include, depending on the particular installation, a gate openalarm 218, a pool cover alarm 216, water pressure sensors 208A (filterinput pressure) and 208B (filter output pressure), vacuum switch 213,gas pressure 224 for the gas supply line 15 to the heater, temperaturesensor 204 (temperature of water entering the heater), temperaturesensor 206 (temperature of water leaving the heater), water pH sensor212 and oxygen reduction potential (ORP) sensor 210 and 212 in the waterline 8. A master control panel 102 is coupled to the controller 100 forproviding a display and command and data input device by which thesystem 100 may communicate with a user. The locations of the varioussensors may vary depending on the installation. For example, the watertemperature sensor 204 may alternatively be placed at the inlet to thepump 80, in the water line between the valve 70 and the pump 80.

FIG. 3 is a simplified block diagram of a pool service system 50. Thisembodiment will be described in the context of a residential pool withspa as illustrated in FIG. 2, although it is to be understood that thesystem can be utilized with larger pool installations, such ashotel/motel pool or spa systems and the like. The system includes thecontroller and power distribution system 100, which receives AC linepower from the main or sub line voltage distribution panel 40. In thisexample, the panel 40 supplies 50 Amp service on line voltage wiring60A, which is connected to a ground fault circuit interrupter (GFCI) 62,and then through line voltage wiring 60B to the controller and powerdistribution system 100. The system 100 distributes line voltage powerto various line voltage loads, and also includes a low voltagetransforming function to provide low voltage AC and DC power at variouslow voltages needed by the electronic devices and low voltage loads.

In this exemplary embodiment, the main line voltage power is providedthrough a single main line voltage service connection 60A, 60B and GFCI62 to system 100, rather than through a plurality of line voltageservice connections each with its own GFCI and circuit breaker circuit.The system 100 is not limited to the 50 Amp main line service, and caninclude auxiliary line services, which can be used to power auxiliaryloads through conventional circuit breaker-protected connections.Typically these auxiliary connections are made on auxiliary circuitboards mounted in the control cabinet. Alternatively, the system mayinclude modules powered through a plurality of GFCI devices.

The system 50 may include the master pool control panel 102 as well as aspa control panel 104. The control panel can be located inside theresidence, adjacent a door leading out to the pool, or in otherlocations convenient for the user. The control panel could also beinstalled on the cover of the controller cabinet 112. The spa controlpanel 104 is typically located adjacent the spa for convenient access byspa users.

FIG. 4 illustrates an exemplary embodiment of a control panel cabinet110 for housing the system 100, and which also includes a servicecontrol panel 112, which includes several touch switches 112A and statusindicator lights 112B. Exemplary techniques for constructing a suitablecontrol panel are described in U.S. Pat. No. 5,332,944. The switchespermit user commands to be entered at the cabinet 110. If the poolcontrol panel is mounted on the cover of the cabinet 110, the servicepanel may be omitted. The service panel may be provided with user inputmeans for operating the controlled devices. For example, the servicepanel 112 in this exemplary embodiment includes manually actuatedcontrol switches/buttons, used to turn on or enable the filter pump, thepool and spa lights, the heater, and auxiliary buttons which can be usedfor such features as the cleaner pump, yard lights, an auxiliary valve,a fiber optic decorative lighting system and an auxiliary pump.Alternatively, a menu system or touchscreen may be employed, from whichthe controlled devices can be operated and settings changed. The servicepanel may be located on the exterior of the hinged lockable cover forthe cabinet 110, and in an exemplary embodiment is water resistant.

FIG. 5 illustrates the master control panel 102, which in this exemplaryembodiment includes an LCD or other display 102A, panel switches 1028and indicator lights 102C. This panel 102 includes a display fordisplaying to the operator various status information and messages, andcontrols which permit the operator to enter commands or input data tothe system 100. The switches accept user commands and inputs, toinitiate system actions or enter information into the controller 100.For example, the switches or buttons can include up and down buttons fortemperature control and programming, a filter button for activating thefilter pump, a light button for controlling the pool and spa lights, aspa button which controls the valves 70 and 72, turns on the spa jetpump, and turns off the cleaner pump if the system is so equipped, aheater enable button to enable operation of the heater, a program buttonto put the system in a programming mode, and auxiliary buttons which canbe used for such features as the cleaner pump, yard lights, an auxiliaryvalve, a fiber optic decorative lighting system and an auxiliary pump.

FIG. 6 is a similar view of the spa control panel 104, which alsoincludes an LCD or other display 104A, panel switches/buttons 104B andindicator lights 104C, which accepts user commands and inputs, toinitiate systems actions or enter information into the controller 100.In an exemplary embodiment, there are several buttons, including abutton for temperature control, buttons to control the spa jets (valvesand filter pump) and an optional jet pump, a spa light button, and anauxiliary button. The panel 104 is mounted at or near the spa 2, abovethe water line. A low voltage cable runs from the panel to thecontroller system 100 in this exemplary embodiment.

FIG. 7 is a schematic block diagram of an exemplary embodiment of thepool/spa service system 50. The service system includes a number ofcomponents which require electrical power for operation and/or control.The electrical power at line voltage is routed through a pool/spacontroller and power distribution system 100. Primary electrical powerin this exemplary embodiment is by the 50 Amp primary service 60A fromthe main panel or 100 Amp sub panel 40. Of course, the particular ampereratings for the circuits of this system are merely exemplary, and couldbe varied in accordance with the demands of particular applications. Theprimary service 60A is provided with a ground fault circuit interrupter(GFCI) 62, to provide ground fault protection for the primary powerservice to the system.

In an exemplary embodiment, the primary line voltage service 60A may beprovided by a 240 VAC line feed, comprising in a typical installation aneutral conductor, a ground conductor, a first voltage phase conductorand a second voltage phase conductor. These conductors areconventionally color coded, so that according to the coding convention,the ground conductor has green insulation, the neutral conductor haswhite insulation, the first voltage phase conductor has black insulationand the second voltage phase conductor has red insulation. The blackconductor has a first polarity phase with respect to the neutralconductor, and the red conductor has a second polarity phase withrespect to the neutral conductor, and 180 degrees different from thephase of the first polarity phase, such that 120 VAC is developedbetween the neutral and the black conductors, 120 VAC is developedbetween the neutral and the red conductors, and 240 VAC is developedbetween the black and the red conductors.

Various exemplary components which are controlled and/or receiveelectrical operating power through the system 100 are shown in FIG. 7.These components can include the valves 70, 72, 74, the water fill spoutvalve 76, the water heater 78, the filter pump 80, the cleaner pump 82,an auxiliary pump 84, a spa jet pump 86, the decorative fiber opticsystem 88, lighting system 90, spa blower 92 and auxiliary lights 94.The foregoing particular components is an illustrative listing; for anygiven pool or spa installation, some of the components may be omitted,and other components may be added, all depending on the design of theparticular installation.

Still referring to FIG. 2, the pool\spa controller 100 receives inputdata signals from various sensors and input sources. These may includeseveral temperature sensors, the air temperature sensor 202 forproviding ambient air temperature, the water temperature sensor 204 forproviding the temperature of the water at the input to the heater, andthe water temperature sensor 206 for providing the temperature of thewater at the output of the heater. Other sensors may include the filterbackpressure sensor system 208 comprising pressure sensors 208A and 208B(FIG. 2), ORP sensor 210, pH sensor 212, vacuum switch or sensor 213,water level sensor 214 for providing a pool water level indication, a“cover off” sensor 216, a “gate locked” sensor 218, and a solar sensor220 for detecting the temperature at a solar heater. The controller mayrespond to the solar temperature, to actuate a valve to divert water topass through a solar heater, if the installation is so equipped, insteadof through the water heater. The water level sensor for example mayinclude a probe which extends into an area at which the water level willreach at a desired fill level, and sense the presence or absence ofwater at this level.

In an exemplary embodiment, a 50 Amp line power connection may be madebetween the main panel 40 for the residence directly to the pool/spacontroller and distribution system 100, through the 50 Amp GFCI 62 and aGFCI trip circuit 500. The system 100 has thereon the necessary terminalconnections for direct connection of the line voltage service conductors(black, red, white, green) for the 50 Amp service. Circuit protectionfor the various devices such as the heater 78, filter pump 80, cleanerpump 82 and auxiliary pump 84 may be provided by circuit protectiondevices, e.g. fuses, mounted on the pool controller circuit board in thepool controller cabinet.

FIG. 8 is a simplified wiring diagram for an exemplary pool and spainstallation. For some installations, not all sensors and controlleddevices may be needed or desired by the owner, and the system shown inFIG. 8 does not explicitly show the identical complement of controlleddevices and sensors as shown for the system of FIG. 7. The samecontroller circuit board may be used in this installation as well as inthe system shown in FIG. 7. The exemplary installation of FIG. 8includes controlled valves 70 and 72, air temperature sensor 202, watertemperature sensor 204 which measures the temperature at the inlet tothe heater, which should be the same as the water temperature in thepool or spa, vacuum switch or sensor 213, spa jet pump 86, filter pump80, water heater 78, spa lights 90A and yard lights 90B.

An exemplary embodiment of the circuit board 250 is diagrammaticallydepicted in FIG. 8, and is connected to the line voltage connectors 242and 244, attached to a terminal block connector. The neutral bus 246 isattached to the terminal block, and a neutral connection 246A is made tothe circuit board. The neutral (white) conductor 60B3 from the 240 VAC,50 A service is connected to the neutral bus. The ground (green)conductor 60B4 from the 50 A service is connected to a ground bus 248attached to a cabinet. The board 250 includes printed wiring conductorpatterns which connect the various circuit devices mounted on the boardand the connector terminals.

The exemplary installation illustrated in FIG. 8 includes two 240 VACloads, the spa jet pump 86 and the filter pump 80. These loads areconnected to 240 VAC service through a 240 VAC connector comprising afirst connector structure mounted on the top surface of the circuitboard, and a removable connector structure 260B (FIG. 8) to whichinsulated conductors or wires are connected running to the loads. Therespective connector structures have respective pins and correspondingplug receptacles which mate together when the connector structure aremated.

Respective terminals of the connector structure 260B may be electricallyconnected to a board printed wiring trace running to the connector 242,and other connections to other terminals of the connector structure 260Bare made through switching relays and fuses to a wiring trace to theconnector 244. By appropriate connection to respective terminals of theconnector structure, 240V service is available. Insulated conductor 86Ais connected to a “red” terminal connection, i.e. a connection which iselectrically connected to connector 242, to which the red conductor ofthe 240V service is connected. Conductor 86B is connected to a “black”terminal connection, i.e. a connection which is electrically connectedthrough a relay and fuse to connector 244, to which the black conductorof the 240V service is connected. Conductor 86C connects the ground bus248 to the spa jet pump.

Similar connections may be made to the filter pump 80 to provide 240Vservice. Thus, wire 80A is connected to another “red” terminalconnection on connector 260B, wire 80B is connected to a “black”terminal connection on connector 260B, and wire 80C connects the groundbus 248 to the filter pump.

In this exemplary embodiment, the 240 VAC loads are controlled byrespective switch devices, e.g. non-latching relays, in turn controlledby the system controller. Each load circuit is also protected fromexcessive current draw by a fuse device. Thus, the spa jet pump 86 iscontrolled by relay 280 and circuit protection is provided by fuse 286,respectively mounted on the circuit board 250. To accomplish this, aseries circuit connection is made between a circuit trace, relay 280 andfuse 286 to the corresponding terminal on connector structure, usingsolder connections to wiring traces formed as part of the board 250. Thefilter pump 80 is controlled by relay 282 and circuit protection isprovided by fuse 288. A spare 240V service circuit is provided, withrelay 284 and fuse 290.

The circuit board 250 further has a 120V service connector, alsocomprising a fixed connector structure mounted to the board, and aremovable connector structure 270B (FIG. 8) connectable to the fixedconnector structure. These connector structures can be implemented inthe same manner as the 240V connector structures, further facilitatingfield wiring of the controller system. Insulated wires running to theload devices are attached to the removable connector structure 270B.Respective terminals of the fixed connector structure are electricallyconnected via wiring traces of the circuit board to the red connector242, the black connector 244 and the neutral connector 272 in turnconnected to the neutral bus 246 via wire 246A. Thus, 120V service ofeither phase (red or black) is available at the connector 270. Theheater 78 is wired to the connector 270 by wires 78A, 78B. When thecontroller system calls for heat, 120 VAC power to activate the heateris supplied, which enables all ignition and temperature regulatingfunctions of the heater. The heater in turn ignites gas supplied to itsinternal gas valve and burner, heating the water which is flowing fromthe pump and filter. The spa light circuit 90A is connected to a blackpolarity connection at connector 270B by wire 90AA, and to the neutralbus 246 by wire 90AB. The yard lights 90B are connected to a redpolarity connection at connector 270B by wire 90BA, and to the neutralbus 246 by wire 90BB. Provision is made for an optional 120V load device238, e.g. an electrical water heater, which can be connected toconnector 270B by wire 238A, and to the neutral bus 246 by wire 238B.

In an exemplary embodiment, each 120 VAC circuit connected through theconnector 270 is controlled by a switch device actuated by themicrocomputer 402, with circuit protection provided by a correspondingfuse, respectively mounted on the circuit board 250. The switch deviceand a corresponding fuse are connected in series between a correspondingline voltage wiring trace (i.e., black, red, white) and a terminal ofthe 120V connector structure. The heater is controlled by relay 300,with circuit protection provided by fuse 292. The optional load 238 iscontrolled by relay 302 and protected by fuse 294. The yard lightcircuit 90B is controlled by relay 304, and protected by fuse 296. Thespa light circuit 90A is controlled by relay 308, and protected by fuse298.

In an exemplary embodiment, the controller system 100 includes amicroprocessor 402 such as a Pic 16C65A CMOS microcomputer marketed byMicrochip, which accepts information from a variety of sensors and actson the information, operating, for example, according to instructionsdescribed more fully in FIGS. 14A-14F of U.S. Pat. No. 6,407,469. Thecontrol system also includes a non-volatile memory 403 (FIG. 1). Thecontroller system is not limited to the use of a controller including amicrocomputer or microprocessor, whose functions can instead beperformed by other circuitry, including, by way of example only, anASIC, or by discrete logic circuitry.

In an exemplary embodiment of a controller system programmed or adaptedto perform a GFCI trip Algorithm, the system may include a configurationsetting, gF (.n/.1/.2/.3/.4/.5/.6/.7), to be enabled (gF is set to anysetting other than .n) for a GFCI trip algorithm to function. In such anexemplary embodiment, the GFCI trip algorithm will not function when thesetting is not enabled. In this embodiment, the GFCI trip Algorithm isenabled when gF is set to any value other than n; conversely, when gF isset to n, the GFCI trip algorithm is disabled.

In an exemplary embodiment, the GFCI trip algorithm may have thefollowing states:

Disabled May be disabled as described above. (gF is set to n)

Armed The GFCI will trip within the number of days specified by gFsetting (gF=1 for 1 day delay, gF=2 for 2 day delay, and so on), if nottripped manually earlier.

Imminent The GFCI will trip within a random number of seconds.

Tripping The GFCI is attempting to trip the GFCI right now.

Passed Last GFCI trip succeeded, so no more automatic trips will occur.

Failed The Tripping state went on too long without losing power.

In an exemplary embodiment, this GFCI state is preserved across powercyclings by storage in a nonvolatile memory.

Upon entering the Tripping state in an exemplary embodiment, thecontroller microprocessor issues a command to turn on the GFCI switchelement, e.g. a triac or relay, for between 200 and 300 ms (to preventburning out the resistor), then waits about 100 ms more (after turningoff the GFCI switch element) to allow for the worst-case power lossdetection time. In an exemplary embodiment, power loss is detected by azero crossing detector, which is connected to an AC signal; power lossis detected when the squared AC zero crossing input signal ceases tocycle. One exemplary circuit for detecting nulls in the power waveformis described in U.S. Pat. No. 6,643,108, at FIG. 15 and column 13, lines48-57. If power loss is not detected by that point, the GFCI tripalgorithm switches to the Failed state. Upon entering the Failed state,the algorithm raises a GFCI Failed condition, which acts like a typicalfault condition except that the panel displays “gFl” and the faultcondition cannot be reset with a button press, in an exemplaryembodiment. For the exemplary embodiment, the fault condition can onlybe reset by cycling power.

In an exemplary embodiment, upon power up, if the microprocessor findsthat it is in the Tripping state (which means the GFCI trip worked), theGFCI trip algorithm switches to the Passed state. Upon power up, if theGFCI trip algorithm finds that it is in the Failed state (which meansthe GFCI didn't trip) or Imminent state (which means the spa lost powerfor some other reason just before the GFCI was scheduled to be tripped),the GFCI trip algorithm switches to Armed state.

In an exemplary embodiment, upon power up, if the microprocessor GFCItrip algorithm is in the Armed state, it remains in the Armed state. Anewly powered up microprocessor initializes to Armed.

In an exemplary embodiment, if, after a power up state evaluation, Armedis the state, a transition to Imminent state is scheduled for the numberof days later specified by the gF setting (each day being 24 hours sincepower-up).

In an exemplary embodiment, when the Imminent state is initiated (eitherdue to a scheduled transition or a GFCI Trip Manually command), atransition to Tripping state is scheduled for a “random” number ofseconds (e.g., between about 0 and 10 seconds) later. In an exemplaryembodiment, there may be some means provided for a spa technician (butnot the end user) to request the GFCI to be tripped as a test of theGFCI. For example, there may be a test mode DIP switch on the controllercircuit board with a setting to put the controller in a test mode, andin the test mode, there may be a predetermined series of control panelbutton pushes (known to the technician) to initiate a GFCI test trip.Since the control panel cover is typically removed to access the DIPswitch, this feature may be available to a spa technician, but not theend user.

In an exemplary embodiment, the actual moment at which the GFCI will betripped by the algorithm will not be predictable, to make it hard foranyone to manually simulate a GFCI. During the Imminent state, the userinterface (as well as the logging of faults into a fault log) will belocked out so that no further changes to the system can be made beforepower is lost. This will allow time for any pending updates to thenonvolatile memory 403 (e.g. an EEPROM) to be written before theTriggered state is entered, so that Triggered state can immediately berecorded in the memory.

If power is not lost after tripping the GFCI trip circuit and the Failedstate is entered, normal memory activity can be resumed. If power islost, then normal memory activity will resume upon the next power-up.

During normal operation, if the power fails for any reason other than asoftware-initiated intentional GFCI trip, there may be no way for thesoftware to tell if the GFCI tripped the power or if the power failedfor some other reason. Therefore the software will act normally on anypower up once in Passed state.

Stuck Relay Detection Algorithm. In an exemplary embodiment, thecontroller system includes a timer that has to run for a certain timeperiod, e.g. a certain number of hours, before a stuck relay conditionis raised. The timer starts counting hours from 0 when the watertemperature is at a predetermined initial threshold temperature, e.g.110° F., or above. The timer is stopped if the water temperature fallsto a predetermined temperature value which is lower than the initialthreshold, e.g. 107° F., or below. (The spa system may include anEconomy or Sleep mode. In an exemplary embodiment the water temperaturesensor may be located in the water recirculation path adjacent the inputto the water heater. If the spa is in Economy or Sleep mode, duringwhich the water heater and pump are not cycled, the controller may notrealize the water temperature is 110° F. or above until it gets to thenext filter cycle, which in an exemplary embodiment may only happen onceevery 24 hours. The temperature sensor may not accurately reflect thewater temperature in the spa tub or pool in this case. In an exemplaryembodiment, even with the spa in an Economy or Sleep mode, a filtercycle is performed every 24 hours, during which the pump is activatedand a temperature reading can be taken which is indicative of the watertemperature in the spa or pool. In other embodiments, the watertemperature sensor may be located so as to directly measure the watertemperature in the spa or pool, and hence the sensor reading reflectsthe water temperature whether the pump is running or not.) In anexemplary embodiment, since the temperature is measured while the timeris running, the heating pump will not be shut off by anyoverheat-related faults, and will continue to poll even in a Sleep orEconomy mode, once an hour, starting one hour after the first such“fault” (i.e. starting and running the timer) lasting an hour or more isdeclared, during all such faults while the timer is running. Thisone-hour hold off should prevent most heater-caused overheats fromcausing false positives.

In an exemplary embodiment, if the temperature ever reliably trendsdownwardly, the timer will restart from 0. For example, this shouldeliminate the condition in which the sensed temperature value alternatesbetween going up and then down for a series of readings. This timerrestart will weed out many conditions which cause the temperature torise for a while but then fall.

In an exemplary embodiment, the controller system will, in the followingconditions, enter or declare a “Stuck Relay” fault (displayed as “Stu”on control panel displays), and set a “Hot” flag in nonvolatile memory403, then after 15 seconds put the GFCI trip Algorithm into the“Imminent” state, thus tripping the GFCI within a dozen or so seconds inan exemplary embodiment.

(i) If the water temperature has risen at least 3° F. degrees in thelast hours, and is now greater than or equal to 116° F., and the timerhas been running for at least 5 hours (since the last restart from 0).

(ii) If the water temperature has risen at least 3° F. degrees since thetimer last restarted, and is now greater than or equal to 120° F., andthe timer has been running for at least 10 hours (since the last restartfrom 0).

(iii) If the water temperature has risen at least 2° F. degrees sincethe timer last restarted, and is now greater than or equal to 120° F.,and the timer has been running for at least 24 hours (since the lastrestart from 0).

A reason for using three different criteria for declaring a “stuckrelay” condition, based on a water temperature sensor reading, is toavoid false positives caused by such factors such as a baking sun forthe installation, e.g. one in Phoenix, Ariz. To avoid needlesslytripping the GFCI, if the temperature is rising very slowly due to thebaking sun, waiting a relatively long period of time to declare a “stuckrelay” condition results in the time window encompassing a night timewhen the temperature will fall. Similarly, waiting a relatively longperiod of time to declare a “Stuck Relay” condition when the temperatureis rising quickly, e.g. from a user filling a spa with water from a hotwater faucet, will prevent an undesirable tripping of the GFCI due tosuch a condition, since the water should cool down after being releasedinto the spa or pool.

Although the foregoing exemplary embodiment uses a water temperaturesensor reading, e.g. a water sensor that detects the temperature ofwater flowing into the heater, other techniques for detectingtemperature creep while eliminating false positives could be employed.For example, an air temperature sensor and/or a solar sensor could beused by the electronic controller to eliminate a baking sun as a causefor GFCI tripping. In one exemplary embodiment, a method is provided fordetecting a malfunctioning pump switch, e.g. a stuck pump relay, in abathing installation having a water holding structure, a recirculatingwater flow path and an electrically powered pump actuated by the pumpswitch for recirculating water through the water flow path, whichincludes monitoring a water temperature of water in the water holdingstructure or water flow path over time, processing a rise in the watertemperature over time and monitored temperature values in an algorithmperformed by a microprocessor to characterize the rise in temperatureand to decide whether the rise is more likely to have been caused by amalfunction in the pump switch, resulting in continuous pump operation,than by another cause of a rise in temperature. This decision may beused to initiate tripping the GFCI.

In an exemplary embodiment, if the GFCI trip algorithm is disabled for agiven installation, then the Stuck Relay fault will persist until poweris turned off, instead of going to GFCI Imminent state. However, the“Hot” flag will still be set. Thus stuck relay detection will be usableon such an installation, even though GFCI tripping isn't available.

In an exemplary embodiment, if the GFCI trip algorithm is enabled butnot yet “Passed,” a “Stuck Relay” fault will still try to trip the GFCI,in the expectation that trip circuit and algorithm are working. But ifnot working, a “GFCI Failed” fault will replace the “Stuck Relay” fault;however, the Hot flag will still be set. In an exemplary embodiment, a“GFCI Failed” condition has display priority over a “stuck” condition ora “hot” condition.

In an exemplary embodiment, if the spa powers up with the Hot flag set:

(i) if the spa powers up outside of a Test Mode, the controller systemwill immediately go into a “Hot” fault. After it goes into a “Hot”fault, and if the GFCI trip Algorithm is in the “Passed” state, it willgo to “Imminent” State after 5 minutes.

(ii) if the GFCI trip Algorithm is not in the “Passed” state (presumablybecause it “Failed” or because it is “Disabled”), the algorithm willstay in the “Hot” fault until power down.

(iii) if the controller system powers up in the “Test” Mode, that willclear the “Hot” flag (thus the next power-up outside of Test Mode willbe normal). In an exemplary embodiment, the spa controller system may bepowered up in the Test mode by placing a DIP switch on the controllersystem board to a predetermined position, which in an exemplaryembodiment will typically only be known to a qualified technician.

In an exemplary embodiment, freeze protection will be active duringStuck Relay faults and Hot faults. Freeze protection may be theautomatic activation of water-stirring equipment (e.g. pumps, blowers,mister, etc.) when a temperature is detected, e.g. at some location inthe water flow path, to be low enough that not activating the equipmentwould raise the danger of the plumbing freezing.

An exemplary main operational routine 700 illustrating the programmedoperation of the microprocessor 402 is shown in FIG. 9A. A start-upprocedure 702, illustrated in further detail in FIG. 9B, is commenced atthe system power-up. The main program is run at 704. In this embodiment,the main program is a round-robin loop, in which many functions may beperformed, e.g. panel service, user interface, accepting inputs fromsensors and external devices, processing conditions and house-keepingfunctions. An interrupt occurs periodically, e.g. in this embodiment,every 1/32 of an AC cycle (i.e. 16.67 milliseconds, or about 20milliseconds). In this exemplary embodiment, the purpose of theinterrupt is to perform reference timekeeping. At 708, the referencetime is updated, and operation returns to the main program at the pointof interruption.

Aspects of an exemplary main program 704 are depicted in FIG. 9B. In oneexemplary embodiment, at least some of the functions may be performed inparallel. In another embodiment, the functions may be performedserially. Functions performed in the main program include panelservicing 704A, which includes functions of communication of informationbetween control panels and the main controller board, a user interfacefunction 704B, which includes functions of interpreting the rawinformation communicated by function 704A, and an accepting inputfunction 704C, which includes polling the sensors and switchescomprising the system and communicating the raw sensor data to the maincontroller board.

Another function 704D performed by the main program in an exemplaryembodiment is that of processing temperature sensor data received byfunction 704C. The processed temperature data is then processed furtherby a “stuck relay” temperature processing function 720. The main program704 also performs a “stuck relay” counter analysis 730. Functions 720and 730 are described more fully below.

Another function 704E performed during the main program in an exemplaryembodiment is a processing conditions function, which processes variousfunctions, one of which is a safety processing function 750, which isdescribed more fully below.

FIG. 9C illustrates an exemplary embodiment of a stuck relay temperatureprocessing function 720, which is entered from the main program. Thisfunction is in a hold mode as long as the water temperature is at 109°F. or below, as represented by decision 720-1 with the loop back if thewater temperature is not greater than or equal to 110° F. If the outcomeof decision 720-1 is affirmative, operation proceeds to decision 720-2,where the running status of a stuck relay counter is checked. If thecounter is not running, the counter state is set to zero at 720-3, thestuck relay history list is cleared at 720-4, and the stuck relaycounter is started at 720-5. At 720-6, the water temperature is checked.If the temperature is less than or equal to 107° F., the stuck relaycounter is stopped at 720-7, and operation returns to 720. If thetemperature is greater than 107° F., operation loops between 720-8 and720-6 until the temperature has changed from the last reading. Theamount of the change and the time of the change is added to the stuckrelay history list at 720-9, and operation loops back to 720-6.

FIGS. 9D-1 and 9D-2 illustrates an exemplary embodiment of the stuckrelay counter analysis process 730, entered from the main program. Thestuck relay list has a record of changes in temperature, in the order inwhich they occurred, since the stuck relay counter last started running.At 730-1, the process will hold until the stuck relay counter isrunning. At 730-2, the counter state is tested, looking at the two mostrecent changes in temperature, and if they were both a decrease by 1degree F. (or more), or if the last change by itself was 2 degrees F.(or more), the temperature will have gone down by 2° F. or more in arow. Since, in an exemplary embodiment, temperature is measured to a1-degree resolution, the measurement is subject to noise causing thetemperature to sometimes go down and back up by one degree. It isdesired not to interpret this “noise” fluctuation as a temperature drop,but any further drop would be interpreted as a temperature drop. Ifaffirmative at 730-2, then at 730-3, the stuck relay counter is set tozero, the stuck relay history list is cleared at 730-4, and operationreturns to 730-1. If the counter state has not gone down by 2° F. ormore in a row at 730-2, the process proceeds to 730-5. If at 730-5 thewater temperature is not greater than or equal to a predetermined value,e.g. 120° F. in this example, operation branches to 730-10. If the watertemperature does exceed the predetermined value at 730-5, the counter ischecked at 730-6. If the counter has not run 24 hours or more, operationproceeds to 730-8. If the test at 730-6 is affirmative, operationproceeds to 730-7, a query as to whether the water temperature has risen2° F. or more since the stuck relay counter was at zero. If no,operation branches to 730-8. If yes, operation proceeds to 730-13 (FIG.9D-2).

Query 730-8 determines whether the counter has run for ten hours ormore. If so, at 730-9, it is determined whether the water temperaturehas risen 3° F. or more since the stuck counter relay was at zero. Ifyes, operation proceeds to 730-13. If not operation proceeds to 730-10,where a query is answered as to whether the water temperature is equalto or greater than 116° F. If not, operation returns to 730-1. If yes,operation proceeds to 730-11, where the counter run duration is tested.If the counter has not been running for 5 hours or more, operationreturns to 730-1. If the counter has been running for 5 hours or more,then at 730-12, it is determined whether the water temperature has risen3° F. or more in the last five hours. If not, operation returns to730-1. If yes, operation proceeds to 730-13, where the “stuck” conditionis declared. At 730-14, a warning message is displayed on the paneldisplay, e.g. “STU.” At 730-15, a “hot” bit or flag is set innonvolatile memory. If the GFCI trip circuit function is enabled, theGFCI trip function 740 is performed (FIG. 9E). If the GFCI function isnot enabled for the installed system, the function enters a continuoushold loop. The “hold” loop is only for this function; however, the“stuck” condition declared results in locking out most other activity onthe spa. Some basic internal functions such as timekeeping willcontinue.

An exemplary embodiment of a GFCI trip function 740 is depicted in FIG.9E, which may be entered from the function depicted in FIG. 9D, and alsofrom the function depicted in FIG. 9, described below. At 740-1, theGFCI state is set to “imminent.” The process waits a “random” orvariable number of seconds, in an exemplary embodiment between one andten seconds, at 740-2. In an exemplary embodiment, the wait time iscomputed from subunits of time, e.g. the seconds and tenths of secondssince the controller was powered up, with the tenths treated as moresignificant and only a modulo-8 of the seconds being used. The time whena technician presses a button is unrelated to the least-significantaspects of how long the controller has been powered up; it is virtually“random.” In other words, the human action at an arbitrary time is thetrigger for the variable number. Of course, other algorithms ortechniques could be employed for determining the variable time. The GFCIstate is then set to “tripping” at 740-3, and the controller generates aGFCI trip command to the trip circuit at 740-4, e.g. for a period of 200to 300 milliseconds. The function waits for a time period after thecommand has been generated and turned off, e.g. 100 milliseconds, at740-5. At this point, if the GFCI trip circuit and the GFCI havefunctioned properly, program execution will not reach 740-7, since powershould have been cut off from the spa system. If the spa is stillrunning at 740-7, a “GFCI failed” condition is set at 740-8, and awarning message, e.g. “GFI,” is displayed on the spa control paneldisplay. The function then enters a “loop forever” mode; the loop isonly for this function; however, the “GFCI failed” condition declaredresults in locking out most other activity on the spa. Some basicinternal functions such as timekeeping will continue.

One exemplary algorithm for calculating a variable, virtually “random”time interval, is the following. 1. Start with the “tenths” value of the“absolute” time; the system has been counting time since power-up to aresolution of tenths of a second. 2. Multiply that value by 10. 3. Takethe “seconds” of the “absolute” time and logically-AND that value with8, then add the result to the result from step 2. 4. Add 1 to be surethe final value is non-zero. 5. The result at this point is the “random”number of tenths of a second.

FIG. 9F illustrates an exemplary embodiment of the start-up process 702entered upon power-up of the spa system and controller. At 702-1, thecontroller determines the GFCI state, which in an exemplary embodimentis data stored in non-volatile memory of the controller. If the state is“armed” operation proceeds immediately to 702-4. If the state is“failed” or “imminent” the GFCI state is set to “armed,” and operationproceeds to 702-4. If the state is “tripping” the GFCI state is set to“passed” and operation proceeds to 702-4. If the new state is the“armed” state, a transition of state is scheduled to occur N days later,before operation proceeds to 702-6. In an exemplary embodiment, N can beone to seven days, as set during system build or initial programming asdescribed above. At 702-6, the state of the “hot” bit is determined. Ifnot set, normal operation is resumed. If the hot bit is set, and if thesystem is not in the test mode at 702-12, the “hot” condition is raisedat 702-8, the control panel display shows a warning message, e.g. “hot,”at 702-9. If the GFCI state is not the “passed” state, the functionenters a loop forever mode. If the GFCI state is the passed state, thenthe function waits for a predetermined period of time, e.g. fiveminutes, and then trips the GFCI trip circuit at 740.

FIG. 9G illustrates an exemplary technique 750 for addressing a detectedsafety condition, which is entered from the main program (FIG. 9B). Thedetection may be performed, e.g., by a signal from a vacuum sensor asdescribed above, indicating a blockage in a water flow path. At 752-1,the program checks to determine whether an external safety signal ispresent. If so, a “safety” condition is declared at 750-2, a safetymessage is displayed on the control panel(s) at 750-3, and commands aregiven by the electronic control system to turn off all devices at 750-4.A timeout timer is started at 750-5, in this example a 5 second timer,during which the control panel buttons are monitored at 750-7 for abutton push, reflecting that the user is aware of the safety condition,and the safety condition cleared at 750-8 as a result, and operationreturns to the main program. If no buttons are pushed and once thetimeout occurs at 750-6, the controller checks to determine whether theexternal safety signal is still present at 750-9. If not, the programreturns to the main program. If the external safety signal is stillpresent, an alarm is activated (750-10), typically an audible alarm, andthe program proceeds to the “trip GFCI” routine 740. In anotherexemplary embodiment, the controller may attempt a different response tothe safety condition, e.g. turning off a water pump and actuating avalve to release air into the water flow path, in an attempt to relievea vacuum condition indicating a block in the flow path, in order torelieve the safety condition. The controller may wait some period oftime after taking this response, before determining whether the safetycondition has been relieved by this response. The wait time may berelatively short, e.g. a matter of seconds, in one exemplary embodiment.If the safety condition is still present after taking the first responseaction, then the GFCI may be tripped.

The GFCI trip circuit and control algorithms may be used in otherinstallations, e.g. a spa installation such as a permanently installedspa, or a portable spa installation, i.e. a spa installation which isnot permanently affixed in a permanent fixture, or a bath. FIG. 10illustrates an overall block diagram of a spa system with typicalequipment and plumbing installed. The system includes a spa 1A forbathers with water, and a control system 2A to activate and manage thevarious parameters of the spa. Connected to the spa 1A through a seriesof plumbing lines 13 are pump 1 and pump 2 for pumping water, a skimmer12 for cleaning the surface of the spa, a filter 20 for removingparticulate impurities in the water, an air blower 6 for deliveringtherapy bubbles to the spa through an air pipe, and an electric heater3A for maintaining the temperature of the spa at a temperature set bythe user. The heater 3A in this embodiment is an electric heater, butother types of heaters, e.g. a coal, oil or gas heater, can be used forthis purpose also. A light 7 may be provided for internal illuminationof the water.

Service voltage power is supplied to the spa control system atelectrical service wiring 15, which can be 120V or 240V single phase 60cycle, 220V single phase 50 cycle, or any other generally accepted powerservice suitable for commercial or residential service. An earth ground16 is connected to the control system and there through to allelectrical components which carry service voltage power and all metalparts. Electrically connected to the control system through cables arethe control panels 8 and 10. All components powered by the controlsystem are connected by cables 14 suitable for carrying appropriatelevels of voltage and current to properly operate the spa.

Water is drawn to the plumbing system generally through the skimmer 12or suction fittings 17, and discharged back into the spa through therapyjets 18.

An exemplary embodiment of the electronic control system is illustratedin schematic form in FIG. 11. The control system circuit assembly boardis housed in a protective enclosure. The heater assembly 3A may beattached to the enclosure, and includes inlet/outlet ports withcouplings for connection to the spa water pipe system.

An exemplary embodiment of the electronic control system 2A includes avariety of electrical components generally disposed on a circuit boardand connected to the service voltage power connection 15. Earth ground16 is brought within the enclosure of the electronic control system andis attached to a common collection point.

In an exemplary embodiment, adjacent to the circuit board, a power andisolation transformer 24 is provided. This transformer converts theservice line power from high voltage with respect to earth ground to lowvoltage, fully isolated from the service line power. A zero crossingdetector (ZCD) is connected at an output of the transformer to detectzero crossings in the AC power waveform, as described above. Alsoprovided on the circuit board, in this exemplary embodiment, is acontrol system computer 35, e.g. a microcomputer such as a Pic 16C65ACMOS microcomputer marketed by Microchip, which accepts information froma variety of sensors and acts on the information, thereby operatingaccording to instructions described more fully in FIG. 9A-9G. Theembodiments are not limited to the use of a controller including amicrocomputer or microprocessor, whose functions can instead beperformed by other circuitry, including, by way of example only, anASIC, or by discrete logic circuitry.

One or more outputs of the computer 35 is displayed on the control panel8 through a character display system rendered optically visible bytechnology generally known in the art. Tactile sensors 22 are providedto convert user instructions to computer readable format which isreturned to the control system computer 35.

Referring to FIGS. 10-11, the equipment used to heat and manage thewater quality, i.e. the heater system 3A, pump 1 and pump 2, blower 6and light 7, are connected via electrical cables 14 to relays 36, 126,129 and 130 on the circuit board 23, which function under the control ofrelay drivers 34, selectively driven by the microcomputer 35. Theserelays and relay drivers function as electrically controlled switches tooperate the powered devices, and may be accomplished by methods wellknown in the art and provide electrical isolation from the servicevoltage power for the low voltage control circuitry. Of course, othertypes of switching devices can alternatively be employed, such as SCRsand triacs.

The control system 2A in this exemplary embodiment includes severalsafety circuits, which protect the system in case of error or failure ofthe components. Shown in the functional schematic diagram of FIG. 11 isthe heater system 3A, which includes in an exemplary embodiment agenerally tubular housing constructed of a corrosion resistant materialsuch as 316 stainless steel, a heater element 42 for heating the water,a heater power connection 37 from heater relays to the terminals of theheater element, and temperature sensors 31 and 32 connected throughlines to appropriate circuitry on the circuit board. These sensors areconnected on the circuit board to both a hardware high limit circuit 33and to the computer control circuit 35. Other types of heaters mayalternatively be employed, e.g. heaters with plastic housings, orheaters shown in US Published patent application nos. 20020050490 and20020000007.

A torroid 30, constructed in accordance with techniques well known inthe art, is provided through which the earth ground connection 16 fromthe heater housing and any other ground connection in the system passes.This torroid is electrically connected by cable 41 to a ground currentdetector circuitry 29. The output of the ground current detector (GCD)is provided to the computer system 35 via an electrical connectionthrough the signal conditioning circuitry.

The service voltage power is provided to the system through a GFCI 27 byelectrical connections shown as 38 and 39. A GFCI trip circuit 500 iscontrolled by the computer 35 in this embodiment, and provides a meansfor inducing a ground fault to trip the GFCI 27.

Although the foregoing has been a description and illustration ofspecific embodiments of the invention, various modifications and changesthereto can be made by persons skilled in the art without departing fromthe scope and spirit of the invention as defined by the followingclaims.

1. A method for controlling a bathing installation, comprising: sensinga water temperature of water in a bathing installation tub or arecirculating water flow path for the bathing installation; starting atimer when said sensed water temperature equals a first predeterminedtemperature threshold; stopping and resetting the timer if said watertemperature falls to a second predetermined temperature threshold whichis less than said first threshold; entering a fault mode if: said sensedwater temperature has risen by a first temperature increment within afirst preceding time interval since the timer was started, and is nowequal to or greater than a third predetermined threshold which isgreater than said first threshold.
 2. A method for controlling a spa,comprising: sensing a water temperature of water in a spa tub or arecirculating spa water flow path; starting a timer when said sensedwater temperature equals a first predetermined temperature threshold;stopping and resetting the timer if said water temperature falls to asecond predetermined temperature threshold which is less than said firstthreshold; entering a fault mode if said sensed water temperature hasrisen by a second temperature increment since said timer was laststarted, and is now equal to or greater than a fourth predeterminedthreshold which is greater than said third threshold.
 3. A method forcontrolling a spa, comprising: sensing a water temperature of water in aspa tub or a recirculating spa water flow path; starting a timer whensaid sensed water temperature equals a first predetermined temperaturethreshold; stopping and resetting the timer if said water temperaturefalls to a second predetermined temperature threshold which is less thansaid first threshold; entering a fault mode if said sensed watertemperature has risen by a third temperature increment since said timerwas last started, and is now greater than or equal to said fourthpredetermined threshold, and said timer has been running for at least asecond preceding time interval.
 4. The method of claim 3, wherein saidfault mode includes setting a fault flag in a nonvolatile memory.
 5. Themethod of claim 3, further comprising performing a disable functionafter setting said default flag to disable power from said spa.
 6. Themethod of claim 5, wherein said performing a disable function comprises:inducing a ground fault to trip a ground fault circuit interruptercircuit.
 7. A method for controlling a spa, comprising: sensing a watertemperature of water in a spa tub or a recirculating spa water flowpath; starting a timer when said sensed water temperature equals a firstpredetermined temperature threshold; stopping and resetting the timer ifsaid water temperature falls to a second predetermined temperaturethreshold which is less than said first threshold; entering a fault modeif: (i) said sensed water temperature has risen by a first temperatureincrement within a first preceding time interval since the timer wasstarted, and is now equal to or greater than a third predeterminedthreshold which is greater than said first threshold; (ii) said sensedwater temperature has risen by a second temperature increment since saidtimer was last started, and is now equal to or greater than a fourthpredetermined threshold which is greater than said third threshold; or(iii) said sensed water temperature has risen by a third temperatureincrement since said timer was last started, and is now greater than orequal to said fourth predetermined threshold, and said timer has beenrunning for at least a second preceding time interval.
 8. The method ofclaim 7, wherein said fault mode includes setting a fault flag in anonvolatile memory.
 9. The method of claim 8, further comprisingperforming a disable function after setting said default flag to disablepower from said spa.
 10. The method of claim 9, wherein said performinga disable function comprises: simulating a ground fault to trip a groundfault circuit interrupter circuit.
 11. A method for monitoring andcontrolling operation of a spa installation including a spa vessel forholding water, a line voltage electrical supply, an electroniccontroller, a ground fault interrupt circuit (GFCI), a water heatersystem and a pump for recirculating water through a recirculating waterflow path, comprising: sensing a stoppage or restricted flow in thewater flow path; inducing a ground fault to trip the GFCI to interruptpower to the pump.
 12. The method of claim 11, wherein said sensing astoppage or restricted flow in the water flow path comprises: monitoringan electrical output signal from a pressure sensor mounted to sense awater pressure in the water flow path.
 13. The method of claim 1,wherein said sensing a water temperature comprises sensing a watertemperature in a recirculating water flow path, and comprises:activating a water pump to circulate water from the tub through thewater flow path past a temperature sensor so that the temperature sensoris sensing water temperature indicative of water temperature in the tub.14. The method of claim 13, wherein said activating a water pump isperformed during a filter cycle conducted periodically, to pass waterthrough a filter connected in the recirculating water flow path withoutactivating a water heater.
 15. The method of claim 14, furthercomprising: activating a filter cycle on a predetermined periodicschedule even in the event the bathing installation is in a sleep or aneconomy mode.
 16. The method of claim 13, wherein the temperature sensoris located in the water recirculation path adjacent an input to a waterheater in the path.
 17. The method of claim 1, wherein said fault modecomprises performing a disable function to disable power from said spa.18. The method of claim 2, wherein said entering said fault modeincludes declaring a stuck relay condition.
 19. The method of claim 18,wherein said fault mode further comprises starting a disable algorithmin a bathing installation electronic controller to trip a ground faultcircuit interrupter to disable power to the bathing installation. 20.The method of claim 3, wherein said sensing a water temperaturecomprises sensing a water temperature in the recirculating water flowpath, and comprises: activating a water pump to circulate water from thetub through the water flow path past a temperature sensor so that thetemperature sensor is sensing water temperature indicative of watertemperature in the tub.